Hello, On the client fmx23 there is only one TCP connection shown by netstat, however there are several connection broken messages: Jan 23 17:16:19 fmx23 syslog-ng[836]: EOF occurred while idle; fd='12' Jan 23 17:16:19 fmx23 syslog-ng[836]: Connection broken; time_reopen='60' The clients have syslog-ng 2.0.3. Daniel Balazs Scheidler wrote:
On Thu, 2008-01-24 at 08:39 +0100, Nagy Daniel wrote:
Hi,
It's syslog-ng v2.0.7 on RHEL4, compiled from source. The system is a log server, it receives logs via TCP from various clients.
After restarting syslog-ng, netstat -t shows that each remote host open only one TCP connection to the server, which is normal. The problem is, that the number of established TCP connections is increasing constantly, but the number of clients is the same.
For example netstat -t --numeric-ports | grep fmx23 now shows:
tcp 0 0 barapp1:514 fmx23.freemail.privat:52391 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50852 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50172 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:59367 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50979 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:55828 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:53013 ESTABLISHED tcp 0 0 barapp1:514 fmx23.freemail.privat:50038 ESTABLISHED
Why is that? AFAIK there should be only one established connection per client. Is it a server or client problem?
Hmm.. strange, it should not do that. It is probably a client problem, can you check if it is indeed the syslog-ng process that opens these connections?
Can you see messages like this on the client:
msg_error("Connection broken", evt_tag_int("time_reopen", self->time_reopen), NULL);
If you enable verbose logging, somewhat more information should be displayed about the reasons why syslog-ng reconnects.